| Package | Affected versions | Patched versions |
|---|---|---|
| com.hazelcast:hazelcast | < 3.11 | 3.11 |
| hazelcast | < 3.11 | 3.11 |
In Hazelcast before 3.11, the cluster join procedure is vulnerable to remote code execution via Java deserialization. If an attacker can reach a listening Hazelcast instance with a crafted JoinRequest, and vulnerable classes exist in the classpath, the attacker can run arbitrary code.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free